thuban 0.3.4 → 0.4.0

package/dist/packages/crucible/seeds/ts/seed-037.ts

@@ -0,0 +1,33 @@
+// [CRUCIBLE-SEED]
+// category: insecure_crypto
+// severity: medium
+// language: typescript
+// expected: timing attack via string comparison of HMAC signatures
+
+import * as crypto from 'crypto';
+
+const WEBHOOK_SECRET = process.env.WEBHOOK_SECRET ?? 'fallback-secret';
+
+export function computeSignature(payload: string): string {
+  return crypto.createHmac('sha256', WEBHOOK_SECRET).update(payload).digest('hex');
+}
+
+export function verifyWebhookSignature(payload: string, receivedSig: string): boolean {
+  const expectedSig = computeSignature(payload);
+  // Timing attack: early exit on first mismatch leaks signature length/prefix
+  return expectedSig === receivedSig;
+}
+
+export function verifyApiKey(providedKey: string, storedKey: string): boolean {
+  // Direct string comparison — vulnerable to timing oracle attack
+  return providedKey === storedKey;
+}
+
+export function checkTokenMatch(a: string, b: string): boolean {
+  if (a.length !== b.length) return false;
+  // Character-by-character comparison — timing side-channel
+  for (let i = 0; i < a.length; i++) {
+    if (a[i] !== b[i]) return false;
+  }
+  return true;
+}

package/dist/packages/crucible/seeds/ts/seed-038 2.ts

@@ -0,0 +1,29 @@
+// [CRUCIBLE-SEED]
+// category: insecure_crypto
+// severity: high
+// language: typescript
+// expected: PBKDF2 with low iteration count and SHA1, plus MD5 data integrity check
+
+import * as crypto from 'crypto';
+
+interface DerivedKey {
+  key: Buffer;
+  salt: string;
+}
+
+export function deriveEncryptionKey(password: string): DerivedKey {
+  const salt = 'static-application-salt-2024'; // Should be random and stored per-key
+  // Only 1000 iterations — NIST recommends 600,000+ for SHA-1
+  const key = crypto.pbkdf2Sync(password, salt, 1000, 32, 'sha1');
+  return { key, salt };
+}
+
+export function checksumFile(data: Buffer): string {
+  // MD5 is collision-prone — not suitable for integrity checks
+  return crypto.createHash('md5').update(data).digest('hex');
+}
+
+export function fingerprintUser(userId: string, email: string): string {
+  // SHA1 fingerprint — deprecated for new security applications
+  return crypto.createHash('sha1').update(`${userId}:${email}`).digest('hex');
+}

package/dist/packages/crucible/seeds/ts/seed-038 3.ts

@@ -0,0 +1,29 @@
+// [CRUCIBLE-SEED]
+// category: insecure_crypto
+// severity: high
+// language: typescript
+// expected: PBKDF2 with low iteration count and SHA1, plus MD5 data integrity check
+
+import * as crypto from 'crypto';
+
+interface DerivedKey {
+  key: Buffer;
+  salt: string;
+}
+
+export function deriveEncryptionKey(password: string): DerivedKey {
+  const salt = 'static-application-salt-2024'; // Should be random and stored per-key
+  // Only 1000 iterations — NIST recommends 600,000+ for SHA-1
+  const key = crypto.pbkdf2Sync(password, salt, 1000, 32, 'sha1');
+  return { key, salt };
+}
+
+export function checksumFile(data: Buffer): string {
+  // MD5 is collision-prone — not suitable for integrity checks
+  return crypto.createHash('md5').update(data).digest('hex');
+}
+
+export function fingerprintUser(userId: string, email: string): string {
+  // SHA1 fingerprint — deprecated for new security applications
+  return crypto.createHash('sha1').update(`${userId}:${email}`).digest('hex');
+}

package/dist/packages/crucible/seeds/ts/seed-038.ts

@@ -0,0 +1,29 @@
+// [CRUCIBLE-SEED]
+// category: insecure_crypto
+// severity: high
+// language: typescript
+// expected: PBKDF2 with low iteration count and SHA1, plus MD5 data integrity check
+
+import * as crypto from 'crypto';
+
+interface DerivedKey {
+  key: Buffer;
+  salt: string;
+}
+
+export function deriveEncryptionKey(password: string): DerivedKey {
+  const salt = 'static-application-salt-2024'; // Should be random and stored per-key
+  // Only 1000 iterations — NIST recommends 600,000+ for SHA-1
+  const key = crypto.pbkdf2Sync(password, salt, 1000, 32, 'sha1');
+  return { key, salt };
+}
+
+export function checksumFile(data: Buffer): string {
+  // MD5 is collision-prone — not suitable for integrity checks
+  return crypto.createHash('md5').update(data).digest('hex');
+}
+
+export function fingerprintUser(userId: string, email: string): string {
+  // SHA1 fingerprint — deprecated for new security applications
+  return crypto.createHash('sha1').update(`${userId}:${email}`).digest('hex');
+}

package/dist/packages/crucible/seeds/ts/seed-039 2.ts

@@ -0,0 +1,35 @@
+// [CRUCIBLE-SEED]
+// category: prototype_pollution
+// severity: high
+// language: typescript
+// expected: prototype pollution via typed recursive merge accepting user object
+
+interface DeepObject {
+  [key: string]: unknown;
+}
+
+function deepMerge<T extends DeepObject>(target: T, source: DeepObject): T {
+  for (const key of Object.keys(source)) {
+    const srcVal = source[key];
+    // TypeScript types don't prevent __proto__ key at runtime
+    if (srcVal !== null && typeof srcVal === 'object' && !Array.isArray(srcVal)) {
+      if (!(target as DeepObject)[key]) (target as DeepObject)[key] = {};
+      deepMerge((target as DeepObject)[key] as DeepObject, srcVal as DeepObject);
+    } else {
+      (target as DeepObject)[key] = srcVal;
+    }
+  }
+  return target;
+}
+
+import { Request, Response, Router } from 'express';
+const router = Router();
+
+router.post('/settings', (req: Request, res: Response) => {
+  const defaults = { theme: 'light', language: 'en', notifications: true };
+  // req.body directly passed — attacker sends {"__proto__": {"isAdmin": true}}
+  const merged = deepMerge(defaults, req.body as DeepObject);
+  res.json({ settings: merged });
+});
+
+export default router;

package/dist/packages/crucible/seeds/ts/seed-039 3.ts

@@ -0,0 +1,35 @@
+// [CRUCIBLE-SEED]
+// category: prototype_pollution
+// severity: high
+// language: typescript
+// expected: prototype pollution via typed recursive merge accepting user object
+
+interface DeepObject {
+  [key: string]: unknown;
+}
+
+function deepMerge<T extends DeepObject>(target: T, source: DeepObject): T {
+  for (const key of Object.keys(source)) {
+    const srcVal = source[key];
+    // TypeScript types don't prevent __proto__ key at runtime
+    if (srcVal !== null && typeof srcVal === 'object' && !Array.isArray(srcVal)) {
+      if (!(target as DeepObject)[key]) (target as DeepObject)[key] = {};
+      deepMerge((target as DeepObject)[key] as DeepObject, srcVal as DeepObject);
+    } else {
+      (target as DeepObject)[key] = srcVal;
+    }
+  }
+  return target;
+}
+
+import { Request, Response, Router } from 'express';
+const router = Router();
+
+router.post('/settings', (req: Request, res: Response) => {
+  const defaults = { theme: 'light', language: 'en', notifications: true };
+  // req.body directly passed — attacker sends {"__proto__": {"isAdmin": true}}
+  const merged = deepMerge(defaults, req.body as DeepObject);
+  res.json({ settings: merged });
+});
+
+export default router;

package/dist/packages/crucible/seeds/ts/seed-039.ts

@@ -0,0 +1,35 @@
+// [CRUCIBLE-SEED]
+// category: prototype_pollution
+// severity: high
+// language: typescript
+// expected: prototype pollution via typed recursive merge accepting user object
+
+interface DeepObject {
+  [key: string]: unknown;
+}
+
+function deepMerge<T extends DeepObject>(target: T, source: DeepObject): T {
+  for (const key of Object.keys(source)) {
+    const srcVal = source[key];
+    // TypeScript types don't prevent __proto__ key at runtime
+    if (srcVal !== null && typeof srcVal === 'object' && !Array.isArray(srcVal)) {
+      if (!(target as DeepObject)[key]) (target as DeepObject)[key] = {};
+      deepMerge((target as DeepObject)[key] as DeepObject, srcVal as DeepObject);
+    } else {
+      (target as DeepObject)[key] = srcVal;
+    }
+  }
+  return target;
+}
+
+import { Request, Response, Router } from 'express';
+const router = Router();
+
+router.post('/settings', (req: Request, res: Response) => {
+  const defaults = { theme: 'light', language: 'en', notifications: true };
+  // req.body directly passed — attacker sends {"__proto__": {"isAdmin": true}}
+  const merged = deepMerge(defaults, req.body as DeepObject);
+  res.json({ settings: merged });
+});
+
+export default router;

package/dist/packages/crucible/seeds/ts/seed-040 2.ts

@@ -0,0 +1,31 @@
+// [CRUCIBLE-SEED]
+// category: prototype_pollution
+// severity: high
+// language: typescript
+// expected: prototype pollution via bracket-notation assignment with user-controlled key path
+
+import { Request, Response, Router } from 'express';
+
+const router = Router();
+
+function setProperty(obj: Record<string, unknown>, keyPath: string, value: unknown): void {
+  const parts = keyPath.split('.');
+  let cursor: Record<string, unknown> = obj;
+  for (let i = 0; i < parts.length - 1; i++) {
+    const part = parts[i];
+    // Allows "__proto__" or "constructor" as path segment
+    if (typeof cursor[part] !== 'object') cursor[part] = {};
+    cursor = cursor[part] as Record<string, unknown>;
+  }
+  cursor[parts[parts.length - 1]] = value;
+}
+
+router.patch('/user/preference', (req: Request, res: Response) => {
+  const { key, value } = req.body as { key: string; value: unknown };
+  const userPrefs: Record<string, unknown> = {};
+  // key = "__proto__.admin" → Object.prototype.admin = value
+  setProperty(userPrefs, key, value);
+  res.json({ updated: true });
+});
+
+export default router;

package/dist/packages/crucible/seeds/ts/seed-040 3.ts

@@ -0,0 +1,31 @@
+// [CRUCIBLE-SEED]
+// category: prototype_pollution
+// severity: high
+// language: typescript
+// expected: prototype pollution via bracket-notation assignment with user-controlled key path
+
+import { Request, Response, Router } from 'express';
+
+const router = Router();
+
+function setProperty(obj: Record<string, unknown>, keyPath: string, value: unknown): void {
+  const parts = keyPath.split('.');
+  let cursor: Record<string, unknown> = obj;
+  for (let i = 0; i < parts.length - 1; i++) {
+    const part = parts[i];
+    // Allows "__proto__" or "constructor" as path segment
+    if (typeof cursor[part] !== 'object') cursor[part] = {};
+    cursor = cursor[part] as Record<string, unknown>;
+  }
+  cursor[parts[parts.length - 1]] = value;
+}
+
+router.patch('/user/preference', (req: Request, res: Response) => {
+  const { key, value } = req.body as { key: string; value: unknown };
+  const userPrefs: Record<string, unknown> = {};
+  // key = "__proto__.admin" → Object.prototype.admin = value
+  setProperty(userPrefs, key, value);
+  res.json({ updated: true });
+});
+
+export default router;

package/dist/packages/crucible/seeds/ts/seed-040.ts

@@ -0,0 +1,31 @@
+// [CRUCIBLE-SEED]
+// category: prototype_pollution
+// severity: high
+// language: typescript
+// expected: prototype pollution via bracket-notation assignment with user-controlled key path
+
+import { Request, Response, Router } from 'express';
+
+const router = Router();
+
+function setProperty(obj: Record<string, unknown>, keyPath: string, value: unknown): void {
+  const parts = keyPath.split('.');
+  let cursor: Record<string, unknown> = obj;
+  for (let i = 0; i < parts.length - 1; i++) {
+    const part = parts[i];
+    // Allows "__proto__" or "constructor" as path segment
+    if (typeof cursor[part] !== 'object') cursor[part] = {};
+    cursor = cursor[part] as Record<string, unknown>;
+  }
+  cursor[parts[parts.length - 1]] = value;
+}
+
+router.patch('/user/preference', (req: Request, res: Response) => {
+  const { key, value } = req.body as { key: string; value: unknown };
+  const userPrefs: Record<string, unknown> = {};
+  // key = "__proto__.admin" → Object.prototype.admin = value
+  setProperty(userPrefs, key, value);
+  res.json({ updated: true });
+});
+
+export default router;

package/dist/packages/crucible/seeds/ts/seed-041 2.ts

@@ -0,0 +1,29 @@
+// [CRUCIBLE-SEED]
+// category: prototype_pollution
+// severity: high
+// language: typescript
+// expected: prototype pollution via lodash _.merge or _.set with user-controlled path
+
+import _ from 'lodash';
+import { Request, Response, Router } from 'express';
+
+const router = Router();
+const globalAppConfig: Record<string, unknown> = {};
+
+router.post('/admin/config/set', (req: Request, res: Response) => {
+  const { path, value } = req.body as { path: string; value: unknown };
+  // _.set with user-controlled path — vulnerable to prototype pollution
+  // e.g. path = "__proto__.isAdmin", value = true
+  _.set(globalAppConfig, path, value);
+  res.json({ ok: true });
+});
+
+router.post('/ui/theme', (req: Request, res: Response) => {
+  const userTheme = req.body as Record<string, unknown>;
+  const defaultTheme = { primary: '#007bff', background: '#fff', text: '#333' };
+  // _.merge pollutes prototype when userTheme contains __proto__
+  const merged = _.merge({}, defaultTheme, userTheme);
+  res.json({ theme: merged });
+});
+
+export default router;

package/dist/packages/crucible/seeds/ts/seed-041 3.ts

@@ -0,0 +1,29 @@
+// [CRUCIBLE-SEED]
+// category: prototype_pollution
+// severity: high
+// language: typescript
+// expected: prototype pollution via lodash _.merge or _.set with user-controlled path
+
+import _ from 'lodash';
+import { Request, Response, Router } from 'express';
+
+const router = Router();
+const globalAppConfig: Record<string, unknown> = {};
+
+router.post('/admin/config/set', (req: Request, res: Response) => {
+  const { path, value } = req.body as { path: string; value: unknown };
+  // _.set with user-controlled path — vulnerable to prototype pollution
+  // e.g. path = "__proto__.isAdmin", value = true
+  _.set(globalAppConfig, path, value);
+  res.json({ ok: true });
+});
+
+router.post('/ui/theme', (req: Request, res: Response) => {
+  const userTheme = req.body as Record<string, unknown>;
+  const defaultTheme = { primary: '#007bff', background: '#fff', text: '#333' };
+  // _.merge pollutes prototype when userTheme contains __proto__
+  const merged = _.merge({}, defaultTheme, userTheme);
+  res.json({ theme: merged });
+});
+
+export default router;

package/dist/packages/crucible/seeds/ts/seed-041.ts

@@ -0,0 +1,29 @@
+// [CRUCIBLE-SEED]
+// category: prototype_pollution
+// severity: high
+// language: typescript
+// expected: prototype pollution via lodash _.merge or _.set with user-controlled path
+
+import _ from 'lodash';
+import { Request, Response, Router } from 'express';
+
+const router = Router();
+const globalAppConfig: Record<string, unknown> = {};
+
+router.post('/admin/config/set', (req: Request, res: Response) => {
+  const { path, value } = req.body as { path: string; value: unknown };
+  // _.set with user-controlled path — vulnerable to prototype pollution
+  // e.g. path = "__proto__.isAdmin", value = true
+  _.set(globalAppConfig, path, value);
+  res.json({ ok: true });
+});
+
+router.post('/ui/theme', (req: Request, res: Response) => {
+  const userTheme = req.body as Record<string, unknown>;
+  const defaultTheme = { primary: '#007bff', background: '#fff', text: '#333' };
+  // _.merge pollutes prototype when userTheme contains __proto__
+  const merged = _.merge({}, defaultTheme, userTheme);
+  res.json({ theme: merged });
+});
+
+export default router;

package/dist/packages/crucible/seeds/ts/seed-042 2.ts

@@ -0,0 +1,33 @@
+// [CRUCIBLE-SEED]
+// category: prototype_pollution
+// severity: medium
+// language: typescript
+// expected: prototype pollution via constructor.prototype path in Object.assign chain
+
+import { Request, Response, Router } from 'express';
+
+const router = Router();
+
+interface PluginConfig {
+  [key: string]: unknown;
+}
+
+function applyPluginOptions(baseOptions: PluginConfig, userOptions: PluginConfig): PluginConfig {
+  // Object.assign shallow-merges — __proto__ key from JSON payload pollutes Object.prototype
+  return Object.assign({}, baseOptions, userOptions);
+}
+
+router.post('/plugins/:id/configure', (req: Request, res: Response) => {
+  const base: PluginConfig = { enabled: true, maxRetries: 3, timeout: 5000 };
+  // req.body passed directly — {"__proto__": {"polluted": true}}
+  const config = applyPluginOptions(base, req.body as PluginConfig);
+  res.json({ configured: true, config });
+});
+
+router.patch('/plugins/:id/update', (req: Request, res: Response) => {
+  // Spread operator with user body — same pollution vector
+  const updated = { ...{}, ...req.body };
+  res.json({ updated });
+});
+
+export default router;

package/dist/packages/crucible/seeds/ts/seed-042 3.ts

@@ -0,0 +1,33 @@
+// [CRUCIBLE-SEED]
+// category: prototype_pollution
+// severity: medium
+// language: typescript
+// expected: prototype pollution via constructor.prototype path in Object.assign chain
+
+import { Request, Response, Router } from 'express';
+
+const router = Router();
+
+interface PluginConfig {
+  [key: string]: unknown;
+}
+
+function applyPluginOptions(baseOptions: PluginConfig, userOptions: PluginConfig): PluginConfig {
+  // Object.assign shallow-merges — __proto__ key from JSON payload pollutes Object.prototype
+  return Object.assign({}, baseOptions, userOptions);
+}
+
+router.post('/plugins/:id/configure', (req: Request, res: Response) => {
+  const base: PluginConfig = { enabled: true, maxRetries: 3, timeout: 5000 };
+  // req.body passed directly — {"__proto__": {"polluted": true}}
+  const config = applyPluginOptions(base, req.body as PluginConfig);
+  res.json({ configured: true, config });
+});
+
+router.patch('/plugins/:id/update', (req: Request, res: Response) => {
+  // Spread operator with user body — same pollution vector
+  const updated = { ...{}, ...req.body };
+  res.json({ updated });
+});
+
+export default router;

package/dist/packages/crucible/seeds/ts/seed-042.ts

@@ -0,0 +1,33 @@
+// [CRUCIBLE-SEED]
+// category: prototype_pollution
+// severity: medium
+// language: typescript
+// expected: prototype pollution via constructor.prototype path in Object.assign chain
+
+import { Request, Response, Router } from 'express';
+
+const router = Router();
+
+interface PluginConfig {
+  [key: string]: unknown;
+}
+
+function applyPluginOptions(baseOptions: PluginConfig, userOptions: PluginConfig): PluginConfig {
+  // Object.assign shallow-merges — __proto__ key from JSON payload pollutes Object.prototype
+  return Object.assign({}, baseOptions, userOptions);
+}
+
+router.post('/plugins/:id/configure', (req: Request, res: Response) => {
+  const base: PluginConfig = { enabled: true, maxRetries: 3, timeout: 5000 };
+  // req.body passed directly — {"__proto__": {"polluted": true}}
+  const config = applyPluginOptions(base, req.body as PluginConfig);
+  res.json({ configured: true, config });
+});
+
+router.patch('/plugins/:id/update', (req: Request, res: Response) => {
+  // Spread operator with user body — same pollution vector
+  const updated = { ...{}, ...req.body };
+  res.json({ updated });
+});
+
+export default router;

package/dist/packages/crucible/seeds/ts/seed-043 2.ts

@@ -0,0 +1,32 @@
+// [CRUCIBLE-SEED]
+// category: prototype_pollution
+// severity: high
+// language: typescript
+// expected: prototype pollution via qs-parsed query params passed to deep clone utility
+
+import * as qs from 'qs';
+import { Request, Response, Router } from 'express';
+
+const router = Router();
+
+function cloneDeep<T extends object>(obj: T): T {
+  return JSON.parse(JSON.stringify(obj)) as T;
+}
+
+function applyFilter<T extends Record<string, unknown>>(base: T, filter: Record<string, unknown>): T {
+  // Merges filter keys directly onto base — __proto__ pollution via qs deep parsing
+  for (const [key, val] of Object.entries(filter)) {
+    (base as Record<string, unknown>)[key] = val;
+  }
+  return base;
+}
+
+router.get('/items', (req: Request, res: Response) => {
+  // qs.parse supports nested objects — ?__proto__[admin]=true becomes {__proto__: {admin:true}}
+  const filter = qs.parse(req.query as Record<string, string>, { allowDots: true, allowPrototypes: true });
+  const baseQuery = { page: 1, limit: 20, active: true };
+  const merged = applyFilter(baseQuery, filter as Record<string, unknown>);
+  res.json({ query: merged });
+});
+
+export default router;

package/dist/packages/crucible/seeds/ts/seed-043 3.ts

@@ -0,0 +1,32 @@
+// [CRUCIBLE-SEED]
+// category: prototype_pollution
+// severity: high
+// language: typescript
+// expected: prototype pollution via qs-parsed query params passed to deep clone utility
+
+import * as qs from 'qs';
+import { Request, Response, Router } from 'express';
+
+const router = Router();
+
+function cloneDeep<T extends object>(obj: T): T {
+  return JSON.parse(JSON.stringify(obj)) as T;
+}
+
+function applyFilter<T extends Record<string, unknown>>(base: T, filter: Record<string, unknown>): T {
+  // Merges filter keys directly onto base — __proto__ pollution via qs deep parsing
+  for (const [key, val] of Object.entries(filter)) {
+    (base as Record<string, unknown>)[key] = val;
+  }
+  return base;
+}
+
+router.get('/items', (req: Request, res: Response) => {
+  // qs.parse supports nested objects — ?__proto__[admin]=true becomes {__proto__: {admin:true}}
+  const filter = qs.parse(req.query as Record<string, string>, { allowDots: true, allowPrototypes: true });
+  const baseQuery = { page: 1, limit: 20, active: true };
+  const merged = applyFilter(baseQuery, filter as Record<string, unknown>);
+  res.json({ query: merged });
+});
+
+export default router;

package/dist/packages/crucible/seeds/ts/seed-043.ts

@@ -0,0 +1,32 @@
+// [CRUCIBLE-SEED]
+// category: prototype_pollution
+// severity: high
+// language: typescript
+// expected: prototype pollution via qs-parsed query params passed to deep clone utility
+
+import * as qs from 'qs';
+import { Request, Response, Router } from 'express';
+
+const router = Router();
+
+function cloneDeep<T extends object>(obj: T): T {
+  return JSON.parse(JSON.stringify(obj)) as T;
+}
+
+function applyFilter<T extends Record<string, unknown>>(base: T, filter: Record<string, unknown>): T {
+  // Merges filter keys directly onto base — __proto__ pollution via qs deep parsing
+  for (const [key, val] of Object.entries(filter)) {
+    (base as Record<string, unknown>)[key] = val;
+  }
+  return base;
+}
+
+router.get('/items', (req: Request, res: Response) => {
+  // qs.parse supports nested objects — ?__proto__[admin]=true becomes {__proto__: {admin:true}}
+  const filter = qs.parse(req.query as Record<string, string>, { allowDots: true, allowPrototypes: true });
+  const baseQuery = { page: 1, limit: 20, active: true };
+  const merged = applyFilter(baseQuery, filter as Record<string, unknown>);
+  res.json({ query: merged });
+});
+
+export default router;

package/dist/packages/crucible/seeds/ts/seed-044 2.ts

@@ -0,0 +1,36 @@
+// [CRUCIBLE-SEED]
+// category: eval_abuse
+// severity: critical
+// language: typescript
+// expected: eval() called with user-controlled expression in typed handler
+
+import { Request, Response, Router } from 'express';
+
+const router = Router();
+
+interface CalcRequest {
+  expression: string;
+}
+
+router.post('/calc', (req: Request, res: Response) => {
+  const { expression } = req.body as CalcRequest;
+  try {
+    // TypeScript types don't prevent runtime eval injection
+    // Attacker: "process.mainModule.require('child_process').execSync('id').toString()"
+    // eslint-disable-next-line no-eval
+    const result = eval(expression);
+    res.json({ result });
+  } catch (err: any) {
+    res.status(400).json({ error: err.message });
+  }
+});
+
+router.get('/render-tpl', (req: Request, res: Response) => {
+  const tpl = req.query.tpl as string;
+  const user = req.session?.user ?? {};
+  // eval of backtick template with user-controlled string
+  const output = eval('`' + tpl + '`');
+  res.send(output);
+});
+
+export default router;